Web frontend and supporting services for lance.blue

M2: ATProto OAuth login master

atrium wrapped in one module; sqlite state/session stores; signed headquarters_session cookie; bidirectional handle verification; loopback and confidential client shapes selected by PUBLIC_URL. The exchange's todo!() in atrium 0.1.7 is contained by running the callback in its own task. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>